CVE-2026-96892: Edimax BR-6428nC Open Redirect Vulnerability

CVE-2026-96892 Overview

CVE-2026-96892 is an open redirect vulnerability [CWE-601] in the Edimax BR-6428nC router, firmware version 1.16. The flaw resides in the websRedirect function of the goform handler. An attacker can manipulate the submit-url argument to redirect authenticated users to an attacker-controlled destination. Multiple endpoints invoke the vulnerable handler, expanding the attack surface. The exploit has been published and the vendor did not respond to disclosure outreach.

Critical Impact
Attackers can craft malicious links that abuse the router's trusted domain to redirect users to phishing or malware-hosting sites after interaction with the device management interface.

Affected Products

Edimax BR-6428nC router
Firmware version 1.16
goform handler endpoints invoking websRedirect

Discovery Timeline

2026-09-24 - CVE-2026-96892 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-96892

Vulnerability Analysis

The vulnerability resides in the websRedirect function invoked by the goform handler on the Edimax BR-6428nC. The handler accepts a submit-url parameter and uses its value as the target of an HTTP redirect without validating that the destination belongs to a trusted domain. An attacker constructs a URL that points to a legitimate router endpoint while supplying an external URL in submit-url. When the victim follows the link and interacts with the page, the device issues a redirect to the attacker-controlled location. Because the initial request originates from a trusted LAN or management interface, users are more likely to trust the destination.

Root Cause

The root cause is missing validation of user-supplied URL input before use in an HTTP redirect response. The websRedirect function treats the submit-url parameter as a trusted value, which maps directly to [CWE-601: URL Redirection to Untrusted Site]. No allow-list or scheme/host check restricts the redirect target.

Attack Vector

Exploitation requires network reach to the device's HTTP interface and user interaction with a crafted link. The attacker delivers a URL referencing a vulnerable goform endpoint with a hostile submit-url value. The router responds with a redirect to the attacker's destination, enabling phishing campaigns that impersonate the router login portal or deliver drive-by malware. Multiple endpoints route through the vulnerable handler, giving attackers flexibility in URL construction.

The exploitation primitive is documented in the public open redirect report on Notion and the VulDB CVE-2026-96892 entry.

Detection Methods for CVE-2026-96892

Indicators of Compromise

HTTP requests to Edimax goform endpoints containing a submit-url parameter with an absolute external URL
HTTP 302 responses from the router pointing to domains outside the local management network
Inbound referrer traffic to phishing domains originating from the router's management IP

Detection Strategies

Inspect web proxy and firewall logs for requests to router management paths that include submit-url=http:// or submit-url=https:// values pointing off-network
Alert on redirect chains that begin at an internal router IP and terminate at newly registered or low-reputation domains
Correlate user clicks on router-hosted URLs with subsequent credential submissions to external hosts

Monitoring Recommendations

Enable DNS logging to flag resolution of external domains referenced in router query strings
Monitor NetFlow for unusual outbound HTTP sessions sourced from clients immediately after accessing the router UI
Track administrative access to the Edimax web interface and review query parameters for untrusted URL values

How to Mitigate CVE-2026-96892

Immediate Actions Required

Restrict access to the router's management interface to trusted management VLANs or hosts
Disable remote (WAN-side) administration on the Edimax BR-6428nC
Educate users to avoid clicking links that reference the router hostname with unfamiliar query parameters

Patch Information

No vendor patch is available. According to the disclosure, the vendor was contacted early but did not respond. Organizations should treat the device as unpatched and consider replacement with a supported platform if continued exposure is unacceptable.

Workarounds

Place the router behind a filtering proxy that strips or rewrites submit-url parameters containing external URLs
Block outbound redirects from the router's management IP to untrusted domains at the perimeter firewall
Replace the Edimax BR-6428nC with a vendor-supported device that receives security updates

bash

# Example firewall rule to restrict management access to a trusted subnet
iptables -A INPUT -p tcp --dport 80 -s 192.0.2.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP